chenhg5/cc-connect · error

weixin: %s: aes key: %w

Error message

weixin: %s: aes key: %w

What it means

Uploading outbound media to the Weixin CDN failed at the key-generation step: the error wraps whatever the random/key derivation step returned, so no AES key could be established for encrypting the image/file/audio payload in uploadToWeixinCDN.

Source

Thrown at platform/weixin/media_outbound.go:65

		rc.contextToken = p.getContextToken(rc.peerUserID)
	}
	if strings.TrimSpace(rc.contextToken) == "" {
		return nil, fmt.Errorf("weixin: missing context_token for peer %q", rc.peerUserID)
	}
	return rc, nil
}

func (p *Platform) uploadToWeixinCDN(ctx context.Context, to string, plaintext []byte, mediaType int, label string) (*cdnUploadedRef, error) {
	if len(plaintext) == 0 {
		return nil, fmt.Errorf("weixin: %s: empty payload", label)
	}
	if strings.TrimSpace(p.cdnBaseURL) == "" {
		return nil, fmt.Errorf("weixin: cdn_base_url is empty")
	}
	rawSize := len(plaintext)
	aesKey := make([]byte, 16)
	if _, err := rand.Read(aesKey); err != nil {
		return nil, fmt.Errorf("weixin: %s: aes key: %w", label, err)
	}
	filekey := randomHex(16)
	req := getUploadURLRequest{
		Filekey:     filekey,
		MediaType:   mediaType,
		ToUserID:    to,
		Rawsize:     rawSize,
		Rawfilemd5:  md5Hex(plaintext),
		Filesize:    aesECBPaddedSize(rawSize),
		NoNeedThumb: true,
		Aeskey:      hex.EncodeToString(aesKey),
	}
	resp, err := p.api.getUploadURL(ctx, req)
	if err != nil {
		return nil, fmt.Errorf("weixin: %s: %w", label, err)
	}
	// 选择上传 URL 和 HTTP client
	var cdnUploadURL string

View on GitHub (pinned to 4000b2338a)

Solutions

1. Inspect the wrapped error to find why crypto/rand failed.
2. Fix the environment: ensure /dev/urandom is available or the getrandom syscall is permitted in the container/sandbox.
3. Restart the process on a healthy host; this failure is environmental, not fixable in code.

Example fix

// docker run before
 docker run --security-opt seccomp=strict.json ...
// after
 docker run ...  # default seccomp allows getrandom

if err := p.SendAudio(ctx, rc, audio, "amr"); err != nil && strings.Contains(err.Error(), "aes key") { log.Error("crypto/rand unavailable; check container entropy access") }

When it happens

Trigger: rand.Read(aesKey) returning an error during SendImage/SendFile/SendAudio — essentially only when the OS CSPRNG is unavailable.

Common situations: Container with no access to /dev/urandom; seccomp/apparmor policy blocking getrandom syscall.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• invalid padded length %d
• invalid pkcs7 padding
• aes key must be 16 bytes, got %d
• ciphertext length %d not aligned to block
• %s: aes_key base64: %w

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/5b0c771bff958bd5. Report an issue: GitHub.